---
typeId: req
recordId: benac-cap-002
fields:
  title: Explicit capability grants
  statement: >-
    A capability grant shall identify package CID, package interface, descriptor scope
    where relevant, invocation contract snapshot where relevant, operation phase,
    capability identifier, scope, issuer principal, authentication context where
    relevant, expiry or revocation metadata where relevant, and evidence relied upon.

    A capability grant shall not be inferred from package import, package trust, package
    name, package author, Station Profile information, package approval text, signature
    verification, or human-readable description.

    A capability grant shall not widen authority beyond the package approval or Local
    Policy record that created it.

    A capability grant shall not grant authority for package operations, interfaces,
    data classes, descriptors, artifacts, resources, or phases outside its recorded
    scope.
  rationale: >-
    Capability authority must be explicit, scoped, attributable, revocable, and separate
    from package content and identity.
  verification: >-
    Tests verify that imported, trusted, signed, and named packages do not receive
    capability authority without explicit grants. Scope substitution tests fail closed.
  testable: true
  status: draft
  area: BENAC-CAP
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Trust, policy, and capability model
  order: 91
---
